A crypto user has lost approximately 100,000 USDT after transferring the funds to a lookalike wallet address planted in the victim’s transaction history 66 days earlier.

Cyvers Alerts reported on Aug. 11 that its monitoring system detected the loss after the victim sent funds to an address controlled by an attacker.

How the $100K address poisoning attack unfolded

About 66 days before the theft, the attacker sent transactions involving the victim’s wallet, according to Cyvers. The activity placed a malicious address in the wallet’s transaction history, where it appeared similar to an address the victim had used for a normal transfer.

When the victim later prepared the 100,000 USDT payment, Cyvers said the user relied on the historical record without comparing the complete destination address. The funds consequently went to the lookalike address rather than the intended recipient.

Address poisoning does not require an attacker to obtain a private key, compromise a smart contract, or take control of the victim’s wallet. Instead, the method depends on the length and format of blockchain addresses, which many wallets and block explorers shorten by displaying only their first and last characters.

Attackers generate addresses that match the visible parts of a recipient’s genuine address and then use small or zero-value transfers to place the imitation in a target’s transaction record. A user who checks only the opening and closing characters can therefore select the attacker’s wallet even though the complete strings are different.

In the latest case, Cyvers attributed the loss to the victim’s failure to check the full address. The security company advised users not to treat transaction history as a trusted address book and recommended verifying every character before approving an on-chain payment.

Attacker converts stolen USDT into 52.8 ETH

Following the transfer, the attacker exchanged the stolen USDT for Ethereum, Cyvers reported. The receiving wallet held approximately 52.8 ETH when the security company published its alert.

Cyvers said the conversion appeared designed to reduce the risk that the stolen stablecoins could be frozen. USDT is issued by Tether through smart contracts that allow specific addresses to be blocked, while native ETH does not have an issuer with an equivalent freezing function.

The conversion also means the value of the attacker’s holdings can change with the ETH market price. Cyvers did not report any recovery, return agreement, or exchange intervention in its initial alert, nor did the company identify the victim publicly.

No evidence cited in the alert suggested that a flaw in Tether, Ethereum, or the victim’s wallet software caused the transfer. Cyvers instead described the incident as a social-engineering attack that used a forged address record to exploit the victim’s payment habits.

Address poisoning losses have reached millions

The $100,000 incident follows several larger cases involving the same method. In February, crypto.news previously reported that two users had lost a combined $62 million after copying fraudulent addresses from their transaction histories.

Scam Sniffer attributed about $50 million of that total to a December 2025 incident, while another victim lost approximately $12.25 million, or around 4,556 ETH at the time, in January 2026. The security company said attackers had quietly inserted lookalike addresses into both victims’ recent activity records.

During the December case, a stablecoin holder first sent a 50 USDT test payment to the correct destination. An attacker then inserted a fraudulent address into the history with a 0.005 USDT dust transaction, after which the victim mistakenly sent 49,999,950 USDT to the poisoned address.

The stolen assets were converted into ETH and spread across several wallets, according to an earlier report on the theft. The victim later offered the attacker a $1 million bounty for the return of the remaining funds and threatened to involve international law enforcement.

Low transaction costs have also made automated poisoning campaigns cheaper to operate. Scam Sniffer said in February that millions of dust transactions were being sent each day, with many created to prepare for possible future thefts rather than move funds between genuine users.

In March, a stablecoin user reported receiving 89 poisoning alerts within 30 minutes after completing only two legitimate transfers. Former Binance CEO Changpeng Zhao subsequently criticized transaction explorers that continued to display the malicious entries.

US lawmakers have proposed a crypto fraud task force

For U.S. users, address poisoning falls within a growing category of digital-asset fraud that lawmakers have sought to address through interagency coordination. Senators Elissa Slotkin and Jerry Moran introduced the bipartisan Strengthening Agency Frameworks for Enforcement of Cryptocurrency Act, known as the SAFE Crypto Act, in 2025.

According to the bill’s sponsors, the proposed legislation would establish a federal task force focused on identifying, monitoring, and preventing cryptocurrency scams. Its members would include representatives from government agencies, law enforcement, digital-asset companies, stablecoin issuers, blockchain intelligence firms, and consumer-protection organizations.

The proposal covers several forms of crypto crime, including investment fraud, money laundering, Ponzi schemes, rug pulls, and fraudulent token sales. Sponsors said the task force would examine scam patterns and improve coordination between federal authorities and private-sector specialists.

The bill does not create a reimbursement program for users who mistakenly authorize irreversible transfers. As earlier coverage explained, its proposed task force would focus on detection, disruption and cooperation among agencies and industry participants.

Full address checks can expose poisoned records

Cyvers advised users to compare complete wallet addresses rather than relying on shortened records in transaction histories. For large transfers, security specialists also recommend confirming the destination through a separate communication channel and sending a small test amount before moving the remaining balance.

A test payment alone may not prevent a poisoning attack, as the December 2025 theft demonstrated. Because an attacker can insert a lookalike address immediately after the test, the sender must verify that the address used for the main transfer is identical to the one used for the test transaction.

Address whitelists can add another check by limiting withdrawals to destinations approved in advance. Hardware wallets can also display transaction details before signing, though users must still read and compare the destination shown on the device.

Wallet interfaces and blockchain explorers have started filtering suspicious entries, but the protections vary by platform. A March report found that Etherscan hid zero-value transfers by default, while BscScan and Basescan required users to activate a “hide 0 amount tx” option to remove such records from view.

Strategy CEO Phong Le said the company plans to resume accumulating Bitcoin later this year, even after shifting business priorities prompted it to sell portions of its holdings in moves that drew scrutiny from the market.

In a Monday interview with FOX Business, Le said Strategy had purchased around 175,000 Bitcoin since the beginning of the year while selling roughly 7,000 BTC, making the company a significant net buyer.

That’s “about 25 times more” buying than selling, Le said. He added that Strategy has gone from the world’s second-largest institutional Bitcoin holder to the largest.

“We’ll get back to buying more Bitcoin throughout the course of the year,” Le said.

Strategy CEO Phong Le appears on FOX Business. Source: FOX

While Strategy has accumulated more than 840,000 BTC, it has sold Bitcoin on four occasions since May, with the most recent sale totaling 1,690 BTC. The company has used proceeds from its recent sales to support preferred stock dividends, share repurchases and its US dollar reserve.

Despite the relatively small size of the sales compared with its overall holdings, Strategy has faced scrutiny for departing from its long-standing “never sell” approach to Bitcoin. The shift highlights the competing demands facing Strategy as a public company, including obligations to common and preferred shareholders alongside its Bitcoin accumulation strategy.

Related: Strategy unveils capital framework to preserve Bitcoin exposure, pay dividends

BTC treasury model faces pressure amid bear market

The corporate Bitcoin treasury model has come under pressure as weaker market conditions challenge the economics that helped fuel its rapid expansion. Public companies hold more than 1.26 million BTC, trailing exchange-traded funds and other funds, which hold more than 1.6 million BTC, according to BitcoinTreasuries.NET.

The model has historically benefited from a financing cycle in which Bitcoin treasury companies traded at premiums to the value of their BTC holdings, allowing them to raise capital through equity or debt and use the proceeds to buy more Bitcoin, according to Novaque Research.

However, that cycle becomes more difficult to sustain when companies trade below the net asset value of their Bitcoin holdings because raising new capital becomes increasingly dilutive to shareholders.

Magazine: Sorry everyone, Bitcoin is headed down to $43,500: Michael Terpin

A U.K. parliamentary group wrote to the bosses of the country’s largest lenders about the lack of banking services for crypto firms.

The “Dear CEO” letter, signed by co-chairs of the Crypto and Digital Assets All-Party Parliamentary Group (APPG), Gurinder Singh Josan and Ed Vaizey, asked banks to explain their approach to providing banking services to U.K. crypto and digital asset businesses.

“We have heard of repeated instances where crypto and digital asset firms have struggled to open accounts with U.K. banks. We have similarly heard reports that several banks have introduced restrictions on crypto-related payments and transactions,” Josan, a Labour MP, and Vaizey, a Conservative peer, wrote in the letter.

British banks that have introduced restrictions on crypto-related payments include HSBC, Nationwide, NatWest, Santander UK and Starling Bank.

Ever since crypto came into being, difficulties around attaining banking relationships have made life hard for industry participants, with the systematic debanking of firms and individuals, particularly in the U.S., being referred to as “Operation Chokepoint 2.0.”

Luke Dashjr, one of the key proponents of BIP-110 soft-fork attempt, has been removed from his position as an editor of such proposals for the development of the Bitcoin network.

The motion’s forwarding and subsequent carrying followed shortly after the controversial BIP-110, an attempt to temporarily restrict use of the Bitcoin network for non-financial purposes, stalled almost immediately after entering a signaling period for miners and node operators to demonstrate their support.

Dashjr, who was one of the most prominent Bitcoin developers driving the BIP-110 initiative, was accused of abusing his editorial authority in doing so, such as attempting to assign the proposal a BIP number before it had been discussed and then quickly merging an update into the repository without following due process.

“The latter is particularly notable given that Luke has otherwise made hardly any contributions to the day-to-day work of the BIP Editors since the additional editors began serving in April 2024: he left fewer than 1% of the BIP Editor comments in the repository since then, and the merge action of this PR was his first since May 2024,” Bitcoin developer Mark Erhardt wrote in a motion calling for Dashjr’s removal on Aug. 9.